Class: HackerOne::Client::Report

Inherits:
Object
  • Object
show all
Defined in:
lib/hackerone/client/report.rb

Constant Summary collapse

PAYOUT_ACTIVITY_KEY = 
"activity-bounty-awarded"
CLASSIFICATION_MAPPING = 
{
  "None Applicable" => "A0-Other",
  "Denial of Service" => "A0-Other",
  "Memory Corruption" => "A0-Other",
  "Cryptographic Issue" => "A0-Other",
  "Privilege Escalation" => "A0-Other",
  "UI Redressing (Clickjacking)" => "A0-Other",
  "Command Injection" => "A1-Injection",
  "Remote Code Execution" => "A1-Injection",
  "SQL Injection" => "A1-Injection",
  "Authentication" => "A2-AuthSession",
  "Cross-Site Scripting (XSS)" => "A3-XSS",
  "Information Disclosure" => "A6-DataExposure",
  "Cross-Site Request Forgery (CSRF)" => "A8-CSRF",
  "Unvalidated / Open Redirect" => "A10-Redirects"
}

Instance Method Summary collapse

Constructor Details

#initialize(report) ⇒ Report

Returns a new instance of Report.



22
23
24
 
# File 'lib/hackerone/client/report.rb', line 22

def initialize(report)
  @report = report
end

Instance Method Details

#classification_label ⇒ Object

Do our best to map the value that hackerone provides and the reporter sets to the OWASP Top 10. Take the first match since multiple values can be set. This is used for the issue label.



75
76
77
78
79
80
81
 
# File 'lib/hackerone/client/report.rb', line 75

def classification_label
  owasp_mapping = vulnerability_types.map do |vuln_type|
    CLASSIFICATION_MAPPING[vuln_type[:attributes][:name]]
  end.flatten.first

  owasp_mapping || CLASSIFICATION_MAPPING["None Applicable"]
end

#created_at ⇒ Object 



34
35
36
 
# File 'lib/hackerone/client/report.rb', line 34

def created_at
  attributes[:created_at]
end

#id ⇒ Object 



26
27
28
 
# File 'lib/hackerone/client/report.rb', line 26

def id
  @report[:id]
end

#issue_tracker_reference_url ⇒ Object 



38
39
40
 
# File 'lib/hackerone/client/report.rb', line 38

def issue_tracker_reference_url
  attributes[:issue_tracker_reference_url]
end

#payment_total ⇒ Object 



49
50
51
 
# File 'lib/hackerone/client/report.rb', line 49

def payment_total
  payments.reduce(0) { |total, payment| total + payment_amount(payment) }
end

#reporter ⇒ Object 



42
43
44
45
46
47
 
# File 'lib/hackerone/client/report.rb', line 42

def reporter
  relationships
    .fetch(:reporter, {})
    .fetch(:data, {})
    .fetch(:attributes, {})
end

#risk ⇒ Object

Excludes reports where the payout amount is 0 indicating swag-only or no payout for the issue supplied



55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/hackerone/client/report.rb', line 55

def risk
  case payment_total
  when HackerOne::Client.low_range || DEFAULT_LOW_RANGE
    "low"
  when HackerOne::Client.medium_range || DEFAULT_MEDIUM_RANGE
    "medium"
  when HackerOne::Client.high_range || DEFAULT_HIGH_RANGE
    "high"
  when HackerOne::Client.critical_range || DEFAULT_CRITICAL_RANGE
    "critical"
  end
end

#summary ⇒ Object 



68
69
70
 
# File 'lib/hackerone/client/report.rb', line 68

def summary
  attributes[:vulnerability_information]
end

#title ⇒ Object 



30
31
32
 
# File 'lib/hackerone/client/report.rb', line 30

def title
  attributes[:title]
end

#writeup_classification ⇒ Object

Bounty writeups just use the key, and not the label value.



84
85
86
 
# File 'lib/hackerone/client/report.rb', line 84

def writeup_classification
  classification_label().split("-").first
end